feat: publish security audit worker in release compose

[man4ish]

Summary

Phase I: adds the security-audit-worker service to both release compose files, now that ghcr.io/omnibioai/omnibioai-security-audit-worker is published by CI (security-audit PR #7). Image-only (no build:), matching every other service in these files. Env vars and depends_on mirror docker-compose.yml's existing security-audit-worker entry, using this repo's release-file convention of required (:?) secret guards instead of dev's silently-defaulting ones. No ports: — it's a Redis Streams consumer loop, not an HTTP service.

Files changed

• docker-compose.release.yml
• docker-compose-release.yml

Out of scope (deliberately untouched)

• STALE_SERVICES.txt — pre-existing, unrelated modification (auto-generated by scripts/deploy_verify.py); left unstaged and out of this commit.
• The pre-existing security-audit API parity gap between the two release compose files — not introduced or fixed here.
• docker-compose.yml — not modified.
• No image build/pull, no tags, no deploy/restart performed as part of this change.

Validation

• git diff --check — clean
• tests/test_compose_release_config.py + tests/test_compose_network_exposure.py — 71 passed

🤖 Generated with Claude Code